servers/mermet/openldap/sourcephile.fr.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (builtins) hasAttr;
   4   inherit (builtins.extraBuiltins) pass-chomp;
   5   inherit (config) networking;
   6   inherit (config.services) openldap postfix dovecot2;
   7   inherit (config.users) users groups;
   8   inherit (pkgs.lib) unlines;
   9   domain = "sourcephile.fr";
  10   domainGroup = "sourcephile";
  11   domainOrg = "sourcephile";
  12   domainSuffix = "dc=" + lib.concatStringsSep ",dc=" (lib.splitString "." domain);
  13   posixAccount =
  14    { uid
  15    , uidNumber
  16    , gidNumber ? uidNumber
  17    , cn ? ""
  18    , sn ? ""
  19    , userPassword ? null # Use slappasswd -o module-load=pw-pbkdf2 -h "{PBKDF2-SHA256}"
  20    , mailAlias ? []
  21    , homeDirectory ? ""
  22    , mailStorageDirectory ? null
  23    , loginShell ? "/run/current-system/sw/bin/bash"
  24    , mailEnabled ? true
  25    , mailForwardingAddress ? []
  26    }:
  27     "\n" + lib.concatStringsSep "\n\n" [
  28     (unlines ([ ''
  29       dn: uid=${uid},ou=accounts,ou=posix,${domainSuffix}
  30       objectClass: person
  31       objectClass: posixAccount
  32       objectClass: shadowAccount
  33       objectClass: PostfixBookMailAccount
  34       objectClass: PostfixBookMailForward
  35       cn: ${cn}
  36       sn: ${sn}
  37       mail: ${uid}@${domain}
  38       mailEnabled: ${if mailEnabled then "TRUE" else "FALSE"}
  39       mailGroupMember: ${domainGroup}''
  40       ]
  41       ++ [ "uidNumber: ${toString uidNumber}" ]
  42       ++ [ "gidNumber: ${toString gidNumber}" ]
  43       ++ [ "homeDirectory: ${homeDirectory}" ]
  44       ++ lib.optional (loginShell != null)  "loginShell: ${loginShell}"
  45       ++ lib.optional (userPassword != null) "userPassword: ${userPassword}"
  46       ++ lib.optional (mailStorageDirectory != null) "mailStorageDirectory: ${mailStorageDirectory}"
  47       ++ map (forward: "mailForwardingAddress: ${forward}") mailForwardingAddress
  48       ++ map (alias: "mailAlias: ${alias}@${domain}") mailAlias
  49       ++ lib.optional (mailAlias == []) "mailAlias:"
  50       # NOTE: required by PostfixBookMailForward
  51     ))
  52     ''
  53       dn: cn=${uid},ou=groups,ou=posix,${domainSuffix}
  54       objectClass: top
  55       objectClass: posixGroup
  56       gidNumber: ${toString gidNumber}
  57       memberUid: ${uid}
  58     ''
  59   ];
  60 in
  61 {
  62 # DEBUG: echo "$(nixops show-option mermet -d production services.openldap.databases."g".data)"
  63 services.openldap.databases."${domainSuffix}" = {
  64   # DEBUG: sudo ldapsearch -LLL -H ldapi:// -D cn=admin,cn=config -Y EXTERNAL -b 'olcDatabase={1}mdb,cn=config' -s sub
  65   # WARNING: newlines matter
  66   conf = ''
  67     dn: olcBackend=mdb,cn=config
  68     objectClass: olcBackendConfig
  69
  70     dn: olcDatabase=mdb,cn=config
  71     objectClass: olcDatabaseConfig
  72     objectClass: olcMdbConfig
  73     # Checkpoint the database periodically in case of system failure
  74     # and to speed up slapd shutdown.
  75     olcDbCheckpoint: 512 30
  76     # Database max size is 1G
  77     olcDbMaxSize: 1073741824
  78     olcLastMod: TRUE
  79     # Database superuser. Needed for syncrepl.
  80     olcRootDN: cn=admin,${domainSuffix}
  81     # Superuser password, generated with slappasswd -h "{SSHA}"
  82     # Commented-out because SASL EXTERNAL mechanism is used.
  83     #olcRootPW: {SSHA}COkATGNe7rs/g8vWcYP5rqt4u5sWdMgP
  84     #
  85     olcDbIndex: objectClass eq
  86     olcDbIndex: cn,uid eq
  87     olcDbIndex: uidNumber,gidNumber eq
  88     olcDbIndex: member,memberUid eq
  89     olcDbIndex: mail eq
  90     olcDbIndex: mailAlias eq
  91     olcDbIndex: mailEnabled eq
  92     #
  93     olcAccess: to attrs=userPassword
  94       by self write
  95       by anonymous auth
  96       by dn="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" write
  97       by * none
  98     olcAccess: to attrs=shadowLastChange
  99       by self write
 100       by dn="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" write
 101       by * none
 102     olcAccess: to dn.sub="ou=posix,${domainSuffix}"
 103       by self read
 104       by dn="gidNumber=${toString groups.nslcd.gid}+uidNumber=${toString users.nslcd.uid},cn=peercred,cn=external,cn=auth" read
 105       ${lib.optionalString (hasAttr postfix.user users) ''by dn="gidNumber=${toString groups.postfix.gid}+uidNumber=${toString users.postfix.uid},cn=peercred,cn=external,cn=auth" read''}
 106       ${lib.optionalString (hasAttr dovecot2.user users) ''by dn="gidNumber=${toString groups.dovecot2.gid}+uidNumber=${toString users.dovecot2.uid},cn=peercred,cn=external,cn=auth" read''}
 107       by dn="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
 108     olcAccess: to *
 109       by self read
 110       by * none
 111   '';
 112   data = ''
 113     dn: ${domainSuffix}
 114     objectClass: top
 115     objectClass: dcObject
 116     objectClass: organization
 117     o: ${domainOrg}
 118
 119     dn: cn=admin,${domainSuffix}
 120     objectClass: simpleSecurityObject
 121     objectClass: organizationalRole
 122     description: ${domainOrg} LDAP administrator
 123     roleOccupant: ${domainSuffix}
 124     userPassword:
 125
 126     dn: ou=posix,${domainSuffix}
 127     objectClass: top
 128     objectClass: organizationalUnit
 129
 130     dn: ou=accounts,ou=posix,${domainSuffix}
 131     objectClass: top
 132     objectClass: organizationalUnit
 133
 134     dn: ou=groups,ou=posix,${domainSuffix}
 135     objectClass: top
 136     objectClass: organizationalUnit
 137
 138     dn: cn=${domainGroup},ou=groups,ou=posix,${domainSuffix}
 139     objectClass: top
 140     objectClass: posixGroup
 141     gidNumber: 20000
 142     memberUid: julm
 143     memberUid: sevy
 144
 145   ''
 146   + lib.concatMapStrings posixAccount [ rec
 147     { uid = "julm";
 148       cn = "Julien Moutinho";
 149       sn = uid;
 150       uidNumber = users.julm.uid;
 151       gidNumber = groups.julm.gid;
 152       mailAlias = [ "julien.moutinho" ];
 153       userPassword = pass-chomp "members/julm/mail/hashedPassword";
 154       mailStorageDirectory =
 155         let stateDir = "/var/lib/dovecot";
 156             d=domain;
 157         in
 158         # I'm personnaly using "maildir:" instead of "sdbox:" to be able to use a local (neo)mutt on it,
 159         # bypassing IMAP because (neo)mutt support of IMAP is very bad
 160         # (can't even have a decent $folder_format (with %n or %m) working,
 161         # neither sorting them by date).
 162         "maildir:${stateDir}/mail/${d}/${uid}/mail.d:LAYOUT=maildir++:UTF-8:CONTROL=${stateDir}/control/${d}/${uid}:INDEX=${stateDir}/index/${d}/${uid}";
 163     }
 164     #{ uid="sevy"; uidNumber=10001; cn="Séverine Popek"; sn="sévy";
 165     #  mailAlias = ["severine.popek" "ouais-ouais"]; }
 166     #{ uid="nomail"; uidNumber=10002; mailAlias = ["noalias"]; mailEnabled = false; }
 167     #{ uid="post"; mailForwardingAddress = ["ju@${domain}"]; }
 168     #{ uid="host"; mailForwardingAddress = ["ju@${domain}"]; }
 169   ];
 170 };
 171 }